Hello, World!
Raidforums - it was the internet's largest cyber crime forum - or at least the largest
one that speaks English.
Anything a cyber criminal might want could be found here.
There were hacking tutorials, guides on how to stay anonymous, but by far their biggest
attraction was their marketplace.
In particular their "leaks market" - where users sold hacked databases containing personal
information for sometimes thousands of dollars.
But after 6 years online, raidforums was themselves raided by law enforcement just a few weeks
ago.
And, this might be difficult to believe, but we now know that this website was started
by your typical 14 year old internet troll - whilst it might have seemed like raidforums
was some kind of super slick operation - this couldn't be further from the truth, its downfall
was epic and hilarious, it's almost as if the owner of it was trying to get caught.
But let's back up a bit, how did raidforums become so famous in the cyber criminal underworld?
So, over the past few years, whenever there was a data leak, it often was often first
posted on Raidforums.
This website was the place to buy leaked data.
For example, a couple years back, the personal details of over a million ledger customers
were leaked on the site.
If you're not familiar ledger is a crypto hardware wallet - for cyber criminals this
dump was an absolute gold mine for phishing, and it's not hard to find people who lost
tens of thousands of dollars in phishing campaigns resulting from this data dump.
But this is really only the tip of the iceberg, the FBI estimates "more than 10 billion unique
records" were sold on raidforums, it really is madness.
Now, you might think the owners of websites that facilitate data leaks like this would
kinda understand what they're doing is wrong, but they wouldn't care, because "money".
But in an interview with the 'therecord' - the owner of raidforums comes across as hilariously
delusional.
So, the interviewer asks Omnipotent - oh by the way, the owner of the site calls himself
Omnipotent, it's like - tell me you have a god complex without telling me you have a
god complex.
But we're just going to call him Omni, because well - it has less syllables.
The interviewer asks Omni if "allow[ing] members to trade stolen personally identifiable information"
was "within legal boundaries".
In Omni's words, the "sale of PII is commonplace in businesses such as Facebook and I see what
these users are doing as no different from what a big corporation like [Facebook] does".
"I should not be personally liable for what people sell or don’t sell on this section,
as there is no way for me personally to know if these users are indeed in the possession
of whatever data they claim to be trading."
So, he claims selling hacked data is no different to what Facebook does - but despite the many
flaws of facebook you do actually have to explicitly agree to handing them your data.
Whereas no one ever agreed to letting some random cyber crook, going by names such as
"MaxPizza" sell their data to the highest bidder, someone who'll then probably just
use the data defraud them.
And then after justifying the sale of personal data, Omni goes on to claim he can't be sure
if hacked data is even being sold on the site.
It's an interesting justification, I'm not sure if he actually believes he's making a
convincing argument or if this is some kind of cope, but anyway.
If you're wondering where that name comes from "Raid", "forums", it's because the site
didn't start off as a hub for cyber criminals - in fact it had relatively humble beginnings.
Omni used to be your average internet troll, he explains "The initial purpose of making
the website was to provide a stable platform for “Twitch raiders.”", hence the name
"raid forums".
Omni, the twitch raider, was only 14 at the time he created the site.
And, I was curious where their anime girl logo comes from, he explains "this was just
a user submission ... many people submit logos and ideas to us".
So there's no real backstory to this, this isn't Omni's teenage Waifu or anything, or
if it is he's not willing to admit it.
Either way, raidforums existed happily for 6 years, and Omni, now 21 years old found
himself a Kingpin in the cyber criminal underworld - at its peak his website had 500 thousand
members, with 20 thousand of them active daily.
Leak after leak was published on raidforums, and there was no real substantial government
intervention, that is until 2018 when problems started cropping up for the website's owner,
Omni.
One summer's day in 2018, Omni - a Portuguese citizen - flew to the US on holiday.
And by this point he must have already been on the radar of the FBI, because they were
waiting for him at the airport with a search warrant for all of his devices.
And this is when we find out Omni isn't very clever, or maybe he thought he was actually
Omnipotent, because the guy took no measures at all to hide the fact that he was running
the world's largest cyber crime forum.
And according to court documents, "His smart phone received numerous emails from the mail
systems at raidforums", "the phone also revealed a discord account with the username Omnipotent".
Now there's bad opsec, but this is just plain embarrassing - and it gets worse.
So his devices were seized by the FBI at the airport, following which he emailed the FBI,
asking if he could have them back.
But he did this using the exact same email address he had used to register the domains
for raidforums' mirror sites.
Why didn't the FBI issue a warrant for his arrest there and then?
I can only imagine they wanted to get him on more charges, and they did.
So, this next bit is actually really kinda funny.
Other than just running raidforums, Omni would sell hacked credit card numbers as a bit of
a side hustle, as you do.
So, he did this under the name "Downloading" on raidforums.
The FBI of course sussed this out, and wanted to catch him red handed.
They responded to one of his posts on raidforums within which he was trying to "sell approximately
2.3 million credit card numbers".
"Law enforcement and Downloading negotiated a sale of 1.1 million of the records" in exchange
for $4000 in bitcoin.
The sale took place on Discord, but after the FBI sent Omni the bitcoin, Omni "blocked
the law enforcement discord account", the FBI was also "blocked from using raidforums".
So basically, Omni had just scammed the FBI out of 4k.
But, remember Omni isn't very clever, I so don't think there's much of a chance Omni
realised he was talking to an FBI agent, I'm guessing the reason he chose to scam them
was that the FBI was probably operating a relatively new raid forums account.
So, the ramifications of Omni scamming someone new to cyber crime are pretty much zero, as
opposed to scamming someone who's well known in the community.
The FBI, no doubt feeling pretty salty, continued their intelligence gathering operation for
a good few months, and they were eventually able to buy some stolen data - this time without
being scammed.
Once American law enforcement were happy with their evidence, things really started to go
downhill for Omni.
In late February of this year rumours began spreading on Twitter that something had happened
to raidforums.
You could visit the site, but every single page redirected to the login screen.
Even if you entered valid credentials you'd just be redirected back to login again.
Something was wrong.
One of RaidForum's admins posted in the official Telegram channel that the "raidforums domain
had been seized", but he didn't say who it had been seized by.
At the time, some people thought Russian authorities had seized it, because due to the Ukraine
war, raidforums had vowed to ban all users connecting from Russia.
But security researchers were given a pretty substantial clue in the form of the nameservers
for the domain having been changed.
Whoever had seized the domain had changed them to "jocelyn.ns.cloudflare.com" and "plato.ns.cloudflare.com".
And it turns out these are nameservers known to be used by US law enforcement for hosting
seized domains.
For example, the illegal VPN company doublevpn.com points to those same nameservers and has done
ever since it was seized.
So essentially US authorities were using the raidforums domain as a honeypot, to scoop
up the credentials of raidforums' users, presumably so they could use those credentials in other
investigations.
But there was no news of what had happened to Omni himself, until about a week ago, when
the US in collaboration with a bunch of international agencies publicly confirmed their operation
against raidforums.
The news hit the mainstream media and Omni was confirmed to have been detained on January
31st.
He was arrested in the UK, apparently he was on holiday here... in January... odd choice.
Omni who we now know to be one "Diogo Santos Coelho" has been charged on six counts, ranging
from fraud to identity theft, and it looks like he's going to be extradited to America
where he'll probably be for a while.
Strangely the recently published indictment only seeks damages of about 215 thousand dollars
from him, which is the amount he will have profited from via raidforums.
Now, whilst sure this is a decent chunk of money, it's virtually nothing given the context,
this guy was running the largest English speaking cyber crime forum on the internet for 6 years
and this is all he made?
That amounts to $36k per year, it's nothing given the risks he was taking.
I can only imagine Omni's business skills are just as bad as his Opsec.
And speaking of bad opsec, there's a couple extra fun facts.
According to court documents, Omni was using a coinbase account registered in his name
to receive illegal funds from raidforums - not smart.
And I was given a heads up by one catatmail on twitter that Omni seems to have been operating
a public github account which openly linked to raidforums, where he has a fork for a MyBB
plugin that seemingly allowed admins on raidforums to read user's messages.
Omni must have been plain dumb, or he thought he was invincible - either way it looks like
he'll be spending his 20s locked up in some American prison.
And it'll be interesting to see if the fact he started raidforums aged only 14 counts
as a mitigating factor in sentencing, let me know your thoughts on that in the comments.
Do you think Omni is any less culpable having started the site as a 14 year old?
If you want to read more into this story, all the court documents are linked in the
description.
This video was made possible by Altium Designer, the world’s number 1 PCB design software.
35 years of innovation and development has gone into this bit of kit, and it really shows.
Nothing else I’ve used comes close to the sheer breadth and depth of features.
If you dabble in PCB design at all, you have to give this a go - the routing engine even
just in of itself is just sublime.
Grab your free trial via the link in the video description.
As always, thanks for watching, you know the drill, make sure to tickle the notification
bell and follow me on the instagrams for behind the scenes content.
And I'll see you in the next video, have a good one.